1 /*------------------------------------------------------------------------- 2 * 3 * libpq-be.h 4 * This file contains definitions for structures and externs used 5 * by the postmaster during client authentication. 6 * 7 * Note that this is backend-internal and is NOT exported to clients. 8 * Structs that need to be client-visible are in pqcomm.h. 9 * 10 * 11 * Portions Copyright (c) 1996-2017, PostgreSQL Global Development Group 12 * Portions Copyright (c) 1994, Regents of the University of California 13 * 14 * src/include/libpq/libpq-be.h 15 * 16 *------------------------------------------------------------------------- 17 */ 18 #ifndef LIBPQ_BE_H 19 #define LIBPQ_BE_H 20 21 #include <sys/time.h> 22 #ifdef USE_OPENSSL 23 #include <openssl/ssl.h> 24 #include <openssl/err.h> 25 #endif 26 #ifdef HAVE_NETINET_TCP_H 27 #include <netinet/tcp.h> 28 #endif 29 30 #ifdef ENABLE_GSS 31 #if defined(HAVE_GSSAPI_H) 32 #include <gssapi.h> 33 #else 34 #include <gssapi/gssapi.h> 35 #endif /* HAVE_GSSAPI_H */ 36 /* 37 * GSSAPI brings in headers that set a lot of things in the global namespace on win32, 38 * that doesn't match the msvc build. It gives a bunch of compiler warnings that we ignore, 39 * but also defines a symbol that simply does not exist. Undefine it again. 40 */ 41 #ifdef _MSC_VER 42 #undef HAVE_GETADDRINFO 43 #endif 44 #endif /* ENABLE_GSS */ 45 46 #ifdef ENABLE_SSPI 47 #define SECURITY_WIN32 48 #if defined(WIN32) && !defined(_MSC_VER) 49 #include <ntsecapi.h> 50 #endif 51 #include <security.h> 52 #undef SECURITY_WIN32 53 54 #ifndef ENABLE_GSS 55 /* 56 * Define a fake structure compatible with GSSAPI on Unix. 57 */ 58 typedef struct 59 { 60 void *value; 61 int length; 62 } gss_buffer_desc; 63 #endif 64 #endif /* ENABLE_SSPI */ 65 66 #include "datatype/timestamp.h" 67 #include "libpq/hba.h" 68 #include "libpq/pqcomm.h" 69 70 71 typedef enum CAC_state 72 { 73 CAC_OK, CAC_STARTUP, CAC_SHUTDOWN, CAC_RECOVERY, CAC_TOOMANY, 74 CAC_SUPERUSER 75 } CAC_state; 76 77 78 /* 79 * GSSAPI specific state information 80 */ 81 #if defined(ENABLE_GSS) | defined(ENABLE_SSPI) 82 typedef struct 83 { 84 gss_buffer_desc outbuf; /* GSSAPI output token buffer */ 85 #ifdef ENABLE_GSS 86 gss_cred_id_t cred; /* GSSAPI connection cred's */ 87 gss_ctx_id_t ctx; /* GSSAPI connection context */ 88 gss_name_t name; /* GSSAPI client name */ 89 #endif 90 } pg_gssinfo; 91 #endif 92 93 /* 94 * This is used by the postmaster in its communication with frontends. It 95 * contains all state information needed during this communication before the 96 * backend is run. The Port structure is kept in malloc'd memory and is 97 * still available when a backend is running (see MyProcPort). The data 98 * it points to must also be malloc'd, or else palloc'd in TopMemoryContext, 99 * so that it survives into PostgresMain execution! 100 * 101 * remote_hostname is set if we did a successful reverse lookup of the 102 * client's IP address during connection setup. 103 * remote_hostname_resolv tracks the state of hostname verification: 104 * +1 = remote_hostname is known to resolve to client's IP address 105 * -1 = remote_hostname is known NOT to resolve to client's IP address 106 * 0 = we have not done the forward DNS lookup yet 107 * -2 = there was an error in name resolution 108 * If reverse lookup of the client IP address fails, remote_hostname will be 109 * left NULL while remote_hostname_resolv is set to -2. If reverse lookup 110 * succeeds but forward lookup fails, remote_hostname_resolv is also set to -2 111 * (the case is distinguishable because remote_hostname isn't NULL). In 112 * either of the -2 cases, remote_hostname_errcode saves the lookup return 113 * code for possible later use with gai_strerror. 114 */ 115 116 typedef struct Port 117 { 118 pgsocket sock; /* File descriptor */ 119 bool noblock; /* is the socket in non-blocking mode? */ 120 ProtocolVersion proto; /* FE/BE protocol version */ 121 SockAddr laddr; /* local addr (postmaster) */ 122 SockAddr raddr; /* remote addr (client) */ 123 char *remote_host; /* name (or ip addr) of remote host */ 124 char *remote_hostname; /* name (not ip addr) of remote host, if 125 * available */ 126 int remote_hostname_resolv; /* see above */ 127 int remote_hostname_errcode; /* see above */ 128 char *remote_port; /* text rep of remote port */ 129 CAC_state canAcceptConnections; /* postmaster connection status */ 130 131 /* 132 * Information that needs to be saved from the startup packet and passed 133 * into backend execution. "char *" fields are NULL if not set. 134 * guc_options points to a List of alternating option names and values. 135 */ 136 char *database_name; 137 char *user_name; 138 char *cmdline_options; 139 List *guc_options; 140 141 /* 142 * Information that needs to be held during the authentication cycle. 143 */ 144 HbaLine *hba; 145 146 /* 147 * Information that really has no business at all being in struct Port, 148 * but since it gets used by elog.c in the same way as database_name and 149 * other members of this struct, we may as well keep it here. 150 */ 151 TimestampTz SessionStartTime; /* backend start time */ 152 153 /* 154 * TCP keepalive settings. 155 * 156 * default values are 0 if AF_UNIX or not yet known; current values are 0 157 * if AF_UNIX or using the default. Also, -1 in a default value means we 158 * were unable to find out the default (getsockopt failed). 159 */ 160 int default_keepalives_idle; 161 int default_keepalives_interval; 162 int default_keepalives_count; 163 int keepalives_idle; 164 int keepalives_interval; 165 int keepalives_count; 166 167 #if defined(ENABLE_GSS) || defined(ENABLE_SSPI) 168 169 /* 170 * If GSSAPI is supported, store GSSAPI information. Otherwise, store a 171 * NULL pointer to make sure offsets in the struct remain the same. 172 */ 173 pg_gssinfo *gss; 174 #else 175 void *gss; 176 #endif 177 178 /* 179 * SSL structures. 180 */ 181 bool ssl_in_use; 182 char *peer_cn; 183 bool peer_cert_valid; 184 185 /* 186 * OpenSSL structures. (Keep these last so that the locations of other 187 * fields are the same whether or not you build with OpenSSL.) 188 */ 189 #ifdef USE_OPENSSL 190 SSL *ssl; 191 X509 *peer; 192 #endif 193 } Port; 194 195 #ifdef USE_SSL 196 /* 197 * These functions are implemented by the glue code specific to each 198 * SSL implementation (e.g. be-secure-openssl.c) 199 */ 200 extern int be_tls_init(bool isServerStart); 201 extern void be_tls_destroy(void); 202 extern int be_tls_open_server(Port *port); 203 extern void be_tls_close(Port *port); 204 extern ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor); 205 extern ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor); 206 207 extern int be_tls_get_cipher_bits(Port *port); 208 extern bool be_tls_get_compression(Port *port); 209 extern void be_tls_get_version(Port *port, char *ptr, size_t len); 210 extern void be_tls_get_cipher(Port *port, char *ptr, size_t len); 211 extern void be_tls_get_peerdn_name(Port *port, char *ptr, size_t len); 212 #endif 213 214 extern ProtocolVersion FrontendProtocol; 215 216 /* TCP keepalives configuration. These are no-ops on an AF_UNIX socket. */ 217 218 extern int pq_getkeepalivesidle(Port *port); 219 extern int pq_getkeepalivesinterval(Port *port); 220 extern int pq_getkeepalivescount(Port *port); 221 222 extern int pq_setkeepalivesidle(int idle, Port *port); 223 extern int pq_setkeepalivesinterval(int interval, Port *port); 224 extern int pq_setkeepalivescount(int count, Port *port); 225 226 #endif /* LIBPQ_BE_H */ 227